Deploying Windows Hello for business for EntraID Hybrid devices

Windows Hello for Business can function in a hybrid environment without Cloud Kerberos trust, key trust, or certificate trust because users can still sign in to Windows and authenticate to Microsoft Entra ID. On Windows, when a user signs in with Windows Hello, Windows obtains a Primary Refresh Token from Microsoft Entra ID. That PRT enables seamless SSO to Microsoft 365 apps and SaaS apps. Trust models are primarily about enabling authentication and SSO to on-premises Active Directory resources in hybrid scenarios, not about basic WHfB sign-in to the device or Microsoft Entra ID.

For the stated environment:

1. Why WHfB is working now
   • WHfB is already provisioned on the devices.
   • Hybrid deployments support WHfB on Microsoft Entra joined and Microsoft Entra hybrid joined devices.
   • With PTA, the planning guidance shows that key trust and Cloud Kerberos trust hybrid models support cloud authentication with Password hash sync (PHS) or Pass-through authentication (PTA).
   • Certificate trust does not support PTA or PHS and requires AD FS.
   • If no on-premises trust model has been deployed, WHfB can still be used for Windows sign-in and Microsoft Entra ID authentication, but on-premises Kerberos-based resource access is the area affected.
2. What Cloud Kerberos Trust adds
   • It is the recommended hybrid deployment model.
   • It enables devices to get a Kerberos TGT that is used for single sign-on to on-premises resources.
   • For Microsoft Entra joined devices accessing on-premises resources, Cloud Kerberos trust is the recommended model because it does not require deploying certificates for Kerberos authentication.
   • In the Entra Private Access Kerberos SSO guidance, Windows Hello for Business SSO requires extra configuration, and the documented deployment steps are to create the Microsoft Entra ID Kerberos server object and enable WHfB Cloud Trust on devices using Intune or Group Policy.
3. Whether Cloud Kerberos Trust is required for WHfB as a passwordless method
   • No. The context supports that WHfB can be used as a passwordless method without Cloud Kerberos trust for device sign-in and Microsoft Entra ID authentication.
   • Cloud Kerberos trust is required when the goal includes SSO to on-premises Active Directory resources from Microsoft Entra joined or hybrid scenarios using WHfB.
   • The passwordless deployment guidance recommends using the Cloud Kerberos Trust method to deploy WHfB for synced users on PCs that are Microsoft Entra joined or Microsoft Entra hybrid joined.
4. Whether to deploy Cloud Kerberos Trust before making WHfB primary
   • If the rollout goal is only passwordless sign-in to Windows and Microsoft Entra-connected apps, Cloud Kerberos trust is not a prerequisite.
   • If users need seamless access to on-premises resources such as file shares or other Kerberos-backed resources, Cloud Kerberos trust should be deployed as part of the rollout.
   • For hybrid environments, Microsoft recommends Cloud Kerberos trust over key trust and certificate trust.

A practical conclusion for this environment is:

• Current WHfB sign-in success is explained by Microsoft Entra ID authentication and PRT issuance.
• The missing trust model mainly limits or changes the experience for on-premises Active Directory resource access and SSO, not basic WHfB usage.
• For a hybrid estate with PTA and on-prem AD, deploying Cloud Kerberos trust before broadening WHfB as the primary passwordless method is the recommended approach when users need passwordless SSO to on-prem resources.

References:

• Plan a Windows Hello for Business deployment
• Passwordless authentication with Microsoft Intune
• Use Kerberos for single sign-on (SSO) to your resources with Microsoft Entra Private Access
• Plan a phishing-resistant passwordless authentication deployment in Microsoft Entra ID
• Enable passwordless security key sign-in to on-premises resources by using Microsoft Entra ID
• Hybrid key trust deployment guide
• Hybrid certificate trust deployment guide